# Automated Waivers **Automated Waivers** allow you to automatically manage waivers for low-risk security policy violations that have no upgrade path (i.e., no safe component version available) and/or if the violating component is not reachable. Once configured, automated waivers will be applied and removed dynamically, based on the upgrade path and reachability, at the time of application evaluations. Violations that are _auto-waived_ will not trigger policy actions, saving time and effort otherwise spent requesting and creating waivers. The _auto-waived_ policy violations will be excluded from subsequent application evaluations, allowing the development teams to focus on the policy violations that are more actionable. Automated waivers are not permanent; they are automatically removed if there is a change in the condition that justified the waiver. For example, if an auto-waiver was applied to a policy violation for a vulnerability that was not reachable, now becomes reachable, the auto-waiver will be removed because it no longer satisfies the _Vulnerability is Not Reachable_ condition. Similarly, if a safe version of the component is now available, the auto-waiver will be removed from the policy violation because it no longer satisfies the _Upgrade Path is Not Available_ condition. Automated waivers are context-aware, leveraging Reachability Analysis to make intelligent, application-specific decisions. Rather than applying waivers based on conditions that are relevant to context of the root or parent parent organization, the system evaluates each violation in the context of the specific application’s usage and risk exposure, and applies automated waivers if relevant to the application context. ## Configure Automated Waivers for Policy Violations You can configure Automated Waivers at the application, organization, or root organization level. Configuration options include the following: - Maximum threat level: This represents the highest level of your acceptable risk threshold. Any violation with a threat level above this value will not be auto-waived **AND** - The reason for applying automated waivers. This includes: 1. Upgrade path is not available Selecting this option will create an auto-waiver for a security policy violation which is not actionable. It implies that a safe version of the component is not available, preventing an upgrade. **Note** Lifecycle evaluates all policies to determine whether a safe version is available, not only the policy that triggered the violation. 2. Vulnerability is not _Reachable_ Selecting this option will create an auto-waiver for a policy violation associated with a component that is not invoked during the application runtime as determined by Reachability Analysis, thus posing minimal risk. Learn more about [Reachability Analysis](https://help.sonatype.com/en/reachability-analysis.html "Reachability Analysis"). **IMPORTANT:**Reachability Analysis **must be** enabled via Sonatype CLI (version 2.4.2-01 or higher) or your CI/CD integration plugins for this option. Check the latest release notes for your [CI/CD plugin](https://help.sonatype.com/en/sonatype-integrations.html#ci-cd-systems-253992) version that supports this feature. An application or organization can have up to three automated waivers, including inherited ones, one for each condition: 1. Upgrade path is not available. 2. Vulnerability is not reachable. 3. A combination of the conditions 1 and 2 above. **Example:** An automated waiver has been configured for application A, with reason selected as "Not Reachable" and a maximum threat level of 8. You cannot create another automated waiver for application A, with the same reason "Not Reachable", because the two threat levels contradict. Instead, edit the existing auto-waiver and adjust the threat level. To configure Automated Waivers for an application or organization: 1. Navigate to _Orgs and Policies_ in the left navigation bar and click on the _Auto-Waivers_ option on the top right scroll bar. 2. The _Auto-Waivers_ row shows a preview of the number of inherited (from root or parent organization) and non-inherited automated waivers. Click on the _Auto-Waivers_ row to view the Automated Waivers page. 3. Click on the _New Auto-Waiver_ button to create a new automated waiver for the selected organization or application. 4. Select the _Threat Level_ and other [reasons](https://help.sonatype.com/en/automated-waivers.html#UUID-9ed00015-ccb9-9b92-4b3b-9f9967513617_N1744658318509) for which you want to configure Automated Waivers. 5. Use the check box to select the reasons for creating the automated waiver. The any/all drop down is enabled only if both options are selected. Select _any_ to auto-waive a policy violation that satisfies _either_ of the two conditions. Select _all_ to auto-waive a policy violation that satisfies _both_ of the two conditions. 6. Click the _Create_ button to complete the configuration of the automated waiver. **Next Steps After Configuring an Automated Waiver** 1. Re-evaluate the application, to auto-waive the existing policy violation. This will apply automated waivers for violations which do not have an upgrade path available. 2. Re-scan the next available CI build of your application or manually scan the application using Sonatype CLI. This will apply automated waivers for policy violations that are not Reachable. ## View Existing Automated Waivers To review the existing automated waivers for your organization or application, 1. Navigate to the organization or application in the secondary left navigation bar. 2. Locate the _Auto-Waivers_ option on the top right scroll bar and click to view the existing automated waivers. The _Details_ column shows _View/Edit_ option for the existing automated waivers. 3. Click on the _View/Edit_ link for details on the selected automated waiver. The _Auto-Waiver Details_ page contains the configuration details (scope, reason, component), date created and the Exclusion Log (list of exclusions that were applied to this automated waiver.) 4. Click on the _Edit_ button to make any changes to the existing automated waiver. Click on the _Delete_ button if this automated waiver is no longer required. For inherited automated waivers, these buttons will be disabled. You can change both, the threat level of the policy violation and the combination of reasons for the automated waiver. Click Update to apply the changes to the automated waiver. **The Edit and Delete Options** Inherited automated waivers cannot be edited or deleted. To edit/delete inherited automated waivers, navigate to the parent organization for which the automated waiver was configured and delete for the parent organization. 5. The Exclusion Log contains a list of all policy violations to which automated waivers were applied, but were excluded or removed manually. Learn more about [Exclusion of Automated Waivers](https://help.sonatype.com/en/automated-waivers.html#UUID-9ed00015-ccb9-9b92-4b3b-9f9967513617_N1745354626112). ## Working with Automated Waivers Applications must be re-evaluated or re-scanned to ensure that automated waivers have been applied to existing policy violations. The application must be **re-evaluated** to apply the auto-waiver for the _Upgrade Path is Not Available_ condition. The application must be **re-scanned** to apply the auto-waiver for the _Vulnerability is not Reachable_ condition. The application report generated, will show the policy violations that are Auto-Waived. 1. Click on the policy violation labeled with the _Auto_ tag to open the component details page. 2. Click on the _Policy Violations_ tab on the top of the component details page. The _Auto_ tag identifies the violation with an automated waiver. 3. Select the policy violation with the _Auto_ tag to view the Security Violation details. 4. Navigate to the _Applicable Waivers_ tab to confirm the waiver is an Automated Waiver, marked by the _Auto_ tag under the _Expiration_ section. Automated Waivers do not expire. If the [conditions for applying the automated waivers](https://help.sonatype.com/en/automated-waivers.html#configure-automated-waivers-for-policy-violations "Configure Automated Waivers for Policy Violations") are no longer satisfied, the policy violation will no longer be auto-waived, after subsequent evaluations. ### Exclusion of Automated Waivers If you no longer want a policy violation for an application to be automatically waived, you can exclude or remove the Automated Waiver by clicking on the _Remove auto-waiver for this policy violation_ setting. When an Automated Waiver is removed from a policy violation, it will be added to the [Exclusion Log](https://help.sonatype.com/en/automated-waivers.html#UUID-9ed00015-ccb9-9b92-4b3b-9f9967513617_N1745354626112), and will not be automatically waived in subsequent evaluations. To re-enable the automated waiver in the Exclusion Log, follow the process to create the automated waiver, or [delete from the exclusion log](https://help.sonatype.com/en/automated-waivers.html#delete-exclusion "Delete Exclusion"). To view all excluded/removed Automated Waivers at the policy violation level, navigate to the Exclusion Log on the Auto-Waivers Details page of Lifecycle. #### Delete Exclusion The Exclusion Log on the _Auto-Waivers Details_ page, contains a list of all policy violations to which automated waivers were applied, but were excluded or removed manually. To re-enable Automated Waivers on the policy violation, navigate to the Exclusion Log. Click on the _delete_ icon in the row corresponding to the policy violation in the list. Click _Continue_ to re-enable the Automated Waiver for the selected policy violation. An Automated Waiver will be applied after the next re-evaluation. ## Policy Re-evaluation Options The application must be **re-evaluated** to apply automated waivers that satisfy the _Upgrade Path is Not Available_ condition, to existing policy violations. The application must be **re-scanned** to apply automated waivers that satisfy the _Vulnerability is not Reachable_, to existing policy violations. Refer to [Re-evaluating vs Re-scanning](https://help.sonatype.com/en/re-evaluating-a-report.html#re-evaluating-vs--re-scanning) for details. We recommend using the most recent evaluation report. Re-evaluating application reports allows you to keep your applications updated with the most recent component upgrade recommendations. A full _Re-evaluate_ will: - apply automated waivers for the _Upgrade path is Not Available_ condition, to security policy violations (as configured). - remove automated waivers if a safe component is available for the remediation of the policy violation. Re-evaluating applications that have automated waivers can cause longer evaluation times. You can skip the re-evaluation of automated waivers by clicking on the _Quick Re-evaluate_ button. A _Quick Re-evaluate_ will skip the re-evaluation of automated waivers and : - Not apply automated waivers to newer policy violations . - Not remove existing automated waivers from policy violations, even if a safe component is available for upgrade. A full _Re-Scan_ will: - Detect the latest reachability status of components - Apply automated waivers that satisfy the _Vulnerability is not Reachable_ condition, to security policy violations (as configured). **Will Automated Waivers Reduce Scan Times?** Enabling Automated Waivers may not necessarily decrease the scan time for subsequent scans as they will still be evaluated for each scan to check for new violations. We recommend using _Quick Re-Evaluate_ for faster results. ## Enabling Automated Waivers Feature The introductory release of this feature (Release 186) requires users to enable it. Refer to [Feature Configuration REST API](https://help.sonatype.com/en/feature-configuration-rest-api.html) for details on enabling the _Automated Waivers_ feature for your instance of Lifecycle. **This feature is enabled by default for release 187 and later.** ## Related REST APIs [Auto Policy Waiver REST API](https://help.sonatype.com/en/auto-policy-waiver-rest-api.html "Auto Policy Waiver REST API") [Exclude Auto Policy Waiver REST API](https://help.sonatype.com/en/exclude-auto-policy-waiver-rest-api.html "Exclude Auto Policy Waiver REST API") [Applicable Waivers REST API](https://help.sonatype.com/en/applicable-waivers-rest-api.html)